# What changed in litestar

> 15 changes in litestar 2 from its official release notes, upgrade guides and advisories: 5 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-21. HTML: https://unstale.sh/pypi/litestar/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## litestar 2

### Security

- Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header (2.22.0) — [security advisory](https://github.com/advisories/GHSA-3QMC-CJ7Q-62HV)
- Litestar has HTML Injection Through its CSRF Token (2.22.0) — [security advisory](https://github.com/advisories/GHSA-542P-WVX7-72M4)
- Litestar's AllowedHosts has a validation bypass due to unescaped regex metacharacters in configured host patterns (2.20.0) — [security advisory](https://github.com/advisories/GHSA-93PH-P7V4-HWH4)
- Litestar's CORS origin allowlist has a bypass due to unescaped regex metacharacters in allowed origins (2.20.0) — [security advisory](https://github.com/advisories/GHSA-2P2X-HPG8-CQP2)
- Litestar's FileStore key canonicalization collisions allow response cache mixup/poisoning (ASCII ord + Unicode NFKD) (2.20.0) — [security advisory](https://github.com/advisories/GHSA-VXQX-RH46-Q2PG)

### New APIs and options

- Route reverse can now take handlers. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Added support for typing.ReadOnly in TypedDict schemas. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)

### Fixes and other changes

- Improved the typing for Accept.best_match. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Fixed serialization support for Pydantic's AwareDatetime. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Stopped checking for Path in the default deserializer. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Fixed KeyError swallowing in the default serializer. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Fixed passing guards to the underlying websocket handler. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Added support for Python 3.14. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Added sniffio as a dependency. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)
- Fixed required-field handling for TypedDict on Python 3.8. (2.19.0) — [release notes](https://github.com/litestar-org/litestar/releases/tag/v2.19.0)